frontend-playbook
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run various shell commands for project initialization (
npx create-eth), environment management (yarn fork), and deployment (yarn build,yarn bgipfs). These are standard operations for Ethereum frontend development. - [EXTERNAL_DOWNLOADS]: Utilizes
npxto fetch and run the latestcreate-ethutility from the npm registry and usescurlto interact with Vercel and Ethereum RPC APIs. These represent interactions with well-known technology services and official registries. - [DYNAMIC_EXECUTION]: Implements a build-time injection using
NODE_OPTIONS="--require ..."to load a locallocalStoragepolyfill. This is a standard technical workaround for static site generation issues in Node.js 25+ environments. - [INDIRECT_PROMPT_INJECTION]: The skill defines a production pipeline where the agent is expected to process user-provided values (such as project names and ENS subdomains) and insert them into shell commands.
- Ingestion points: Placeholders in
SKILL.mdfor project variables and interactive user input. - Boundary markers: Absent in the instructional text.
- Capability inventory: File system manipulation (
rm -rf), package execution (npx), and network interactions (curl). - Sanitization: Not explicitly documented in the provided instructions.
Audit Metadata